CVE-2018-16555

5.4MEDIUM

Key Information:

Vendor
Siemens
Status
Scalance S602, Scalance S612, Scalance S623, Scalance S627-2m
Vendor
CVE Published:
13 December 2018

Summary

A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All versions < V4.0.1.1), SCALANCE S627-2M (All versions < V4.0.1.1). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.

Affected Version(s)

SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M SCALANCE S602 : All versions < V4.0.1.1 < SCALANCE S602 : All versions V4.0.1.1

SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M SCALANCE S612 : All versions < V4.0.1.1 < SCALANCE S612 : All versions V4.0.1.1

SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M SCALANCE S623 : All versions < V4.0.1.1 < SCALANCE S623 : All versions V4.0.1.1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-24298...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/105937
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.